In modern data processing systems, particularly with respect to enterprise networks, attacks against the network by unauthorized intruders are a continuing problem. This problem is made particularly acute by the Internet, and the necessity for enterprises to have Internet connectivity. Typically, enterprise networks employ an intrusion detection system (IDS) to monitor the network. Typically an IDS will simply page a system administrator or log the incident. More sophisticated systems may terminate the unauthorized connection and deny future logins. However, such intrusion prevention schemes are unworkable if the compromised login happens to be “root.”
Moreover, typical IDS operate on a system-by-system basis. That is, each system attached to the enterprise network performs its own IDS function. However, an intruder may have broken into an edge node, snooped passwords on the enterprise network, and then connected to the next node via a Telnet session. (It would be recognized by those of ordinary skill in the art that Telnet is the protocol within the TCP/IP suite of protocols that establishes a emulated terminal session between two network systems.) Thus, although an intruder may be denied access to the most sensitive nodes via their respective IDS, the intruder may still have access to a multiplicity of nodes on the enterprise system.
Therefore, there is a need in the art for systems and methods to deny access to potential intruders at the edge node. As described further hereinbelow in conjunction with FIG. 1, an edge node connects the enterprise network to an external network such as the Internet.